Senior Security Analyst

Job Summary

We are looking for a highly skilled Senior Security Analyst with 6–7 years of hands-on experience in Vulnerability Assessment and Penetration Testing (VAPT) across web applications, APIs, mobile applications (Android/iOS), internal and external infrastructure, and AI-powered applications.

The candidate must have strong expertise in manual penetration testing, vulnerability validation, exploitation, security reporting, and remediation guidance. Client handling, technical reporting, and the ability to independently manage end-to-end security assessments are mandatory requirements.

The ideal candidate should be capable of leading technical assessments, communicating findings to clients and stakeholders, mentoring junior team members, and conducting security testing of AI/LLM-based applications and integrations.

Key Responsibilities

1. Web Application and API Penetration Testing

• Conduct manual and automated penetration testing of web applications, REST/SOAP APIs, and GraphQL endpoints.

• Identify and validate vulnerabilities related to authentication, authorization, access control, injection, SSRF, XSS, CSRF, IDOR/BOLA, business logic, file uploads, and privilege escalation.

• Assess JWT, OAuth 2.0, session management, API keys, rate limiting, and sensitive data exposure.

• Perform in-depth testing aligned with OWASP Top 10, OWASP API Security Top 10, and OWASP Web Security Testing Guide.

• Identify complex attack chains and business logic vulnerabilities that automated scanners may miss.

2. Mobile Application Penetration Testing

• Perform static and dynamic security testing of Android APK and iOS IPA applications.

• Analyze application binaries, configurations, permissions, local storage, cryptographic implementations, and network communications.

• Identify insecure data storage, hardcoded secrets, certificate validation weaknesses, insecure deep links, WebView issues, and runtime vulnerabilities.

• Use tools such as MobSF, JADX, apktool, ADB, Frida, objection, and Burp Suite.

• Validate mobile application vulnerabilities and assess associated backend API security.

3. Internal and External Infrastructure Penetration Testing

• Conduct infrastructure VAPT across servers, endpoints, network devices, VPNs, and externally exposed services.

• Perform network discovery, service enumeration, vulnerability validation, exploitation, and privilege escalation testing.

• Assess Windows, Linux, Active Directory, domain controllers, and common enterprise services.